build(deps): bump the minor-and-patch group with 5 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates:

Package	From	To
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.1.0	3.1.1
com.deepgram:deepgram-java-sdk	0.8.0	0.11.0
com.tngtech.archunit:archunit-junit5	1.5.0	1.5.1
com.diffplug.spotless	8.10.0	8.10.4
gradle-wrapper	9.7.1	9.8.1

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.0 to 3.1.1

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.1.1 released!

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

New Contributors

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.1] - 2026-09-06

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

Commits

• 1cc87a7 [maven-release-plugin] prepare release v3.1.1
• 4e8ac26 docs: record the swagger-ui 5.32.14 upgrade as a security fix for 3.1.1
• 958c79a Merge swagger-core 2.2.55 upgrade
• cf7d7c7 Upgrade swagger-core to 2.2.55
• 186adb3 Record the swagger-core 2.2.54 upgrade in the changelog
• 2498ffb Merge pull request #3351 from Mattias-Sehlstedt/update-swagger-core
• d78abd9 upgrade swagger-core from 2.2.53 to 2.2.54
• 9f7f099 Rewrite a copy of a Spring Data REST association property
• f47060e Record #3321 in the changelog and align the buildRequestBody indent
• ccb2fc0 Merge pull request #3323 from Mattias-Sehlstedt/feature/3321-login-example-va...
• Additional commits viewable in compare view

Updates com.deepgram:deepgram-java-sdk from 0.8.0 to 0.11.0

Release notes

Sourced from com.deepgram:deepgram-java-sdk's releases.

v0.11.0

0.11.0 (2026-10-01)

⚠ BREAKING CHANGES

• regen: SharedTopics and SharedIntents expose getSegments() directly; SharedTopicsResults, SharedTopicsResultsTopics, SharedIntentsResults, and SharedIntentsResultsIntents are removed and the segment item types are renamed (see docs/Migrating-v0.10-to-v0.11.md). SpeakV2ConfigureFailureCode.Visitor<T> gains visitControlCombinationInvalid(); existing Visitor implementations must add it.

Features

• regen: add Flux TTS Controls (#120) (01f75a4)

v0.10.2

0.10.2 (2026-09-24)

Features

• Client lifecycle: DeepgramClient and AsyncDeepgramClient now implement AutoCloseable for try-with-resources. Closing a root client releases SDK-owned OkHttp dispatcher and connection-pool resources, while caller-provided OkHttpClient instances remain caller-owned; close associated WebSocket clients before the root client. (#114) (ff9fdd4)
• Listen v2 (Flux): configure numerals during an active session with wsClient.sendConfigure(ListenV2Configure.builder().numerals(true).build()); the setting applies to turns transcribed after the update. (#114) (ff9fdd4)

v0.10.1

0.10.1 (2026-09-18)

Features

• Agent: add V1WebSocketClient#onFunctionCallCancelled(...) for cancelled function-call events. Function settings also support deferUntilEot(true) to defer irreversible actions until the user's turn is confirmed. (#110) (be27248)

Bug Fixes

• WebSockets: complete peer-initiated close handshakes, set the ready state to CLOSED, and invoke onDisconnected(...) when the server closes a connection.
• Listen v2: suppress automatic reconnect only after the active connection successfully sends CloseStream and receives a no-status (1005) close; server-initiated closes continue to follow the configured reconnect policy.

v0.10.0

0.10.0 (2026-09-11)

Agent force-end-turn support, Flux TTS expressivity controls, and a wider Flux TTS speed range. This pre-1.0 minor release also removes stale TTS symbols.

⚠ BREAKING CHANGES

• Speak v2 (Flux TTS): the SpeakV2Speed type and its named speed constants are removed. V2ConnectOptions#speed remains a numeric Double; configure speed directly, for example .speed(1.05).
• Speak v1 (Aura TTS): remove SpeakV1Model.AURA2PERSEO_IT, AudioGenerateRequestModel.AURA2PERSEO_IT, their Value enum entries, and the associated Visitor.visitAura2PerseoIt() methods. The aura-2-perseo-it model was never served by the API and is no longer in the specification. Use a supported Speak v1 model instead. See the v0.9 to v0.10 migration guide.

Features

• Agent: add AgentV1ForceEndTurn and V1WebSocketClient#sendForceEndTurn(...) to end the current turn on demand. Agent Deepgram speak providers using Flux (version: "v2") also accept expressivity, a whole-number calm-to-animated setting from -2 to 2; 0 is the default. (#100) (cbadf05)
• Speak v2 (Flux TTS): batch requests and WebSocket connections accept expressivity from -2 to 2. speed now accepts values from 0.5 to 1.5 in 0.05 increments, instead of 0.85 to 1.15. (#100) (cbadf05)

v0.9.0

0.9.0 (2026-08-25)

... (truncated)

Changelog

Sourced from com.deepgram:deepgram-java-sdk's changelog.

0.11.0 (2026-10-01)

⚠ BREAKING CHANGES

• Topics and Intents: SharedTopics and SharedIntents now expose getSegments() directly. The obsolete nested results wrappers and segment item types are removed. See the v0.10 to v0.11 migration guide.
• Speak v2: SpeakV2ConfigureFailureCode.Visitor<T> now requires visitControlCombinationInvalid().

Features

• Speak v2 (Flux TTS): Add inline pause markers for batch requests and IPA pronunciation overrides for batch and WebSocket requests. Invalid pause-plus-pronunciation and non-default-speed-plus-pronunciation combinations report CONTROL_COMBINATION_INVALID; pause markers on WebSocket requests produce DATA-0002. See Speed, Pause, Pronunciation. (#120) (01f75a4)

Changed

• HTTP retries: The configured HTTP timeout now applies to each retry attempt, so retried requests can exceed the configured timeout. If a later retry fails at the transport layer, the SDK returns the earlier retryable HTTP response with its status, headers, and body.
• Client lifecycle: Closing an SDK-owned root client now disconnects tracked WebSocket clients before releasing OkHttp resources.

0.10.2 (2026-09-24)

Features

• Client lifecycle: DeepgramClient and AsyncDeepgramClient now implement AutoCloseable for try-with-resources. Closing a root client releases SDK-owned OkHttp dispatcher and connection-pool resources, while caller-provided OkHttpClient instances remain caller-owned; close associated WebSocket clients before the root client. (#114) (ff9fdd4)
• Listen v2 (Flux): configure numerals during an active session with wsClient.sendConfigure(ListenV2Configure.builder().numerals(true).build()); the setting applies to turns transcribed after the update. (#114) (ff9fdd4)

0.10.1 (2026-09-18)

Features

• Agent: add V1WebSocketClient#onFunctionCallCancelled(...) for cancelled function-call events. Function settings also support deferUntilEot(true) to defer irreversible actions until the user's turn is confirmed. (#110) (be27248)

Bug Fixes

• WebSockets: complete peer-initiated close handshakes, set the ready state to CLOSED, and invoke onDisconnected(...) when the server closes a connection.
• Listen v2: suppress automatic reconnect only after the active connection successfully sends CloseStream and receives a no-status (1005) close; server-initiated closes continue to follow the configured reconnect policy.

0.10.0 (2026-09-11)

Agent force-end-turn support, Flux TTS expressivity controls, and a wider Flux TTS speed range. This pre-1.0 minor release also removes stale TTS symbols.

⚠ BREAKING CHANGES

• Speak v2 (Flux TTS): the SpeakV2Speed type and its named speed constants are removed. V2ConnectOptions#speed remains a numeric Double; configure speed directly, for example .speed(1.05).
• Speak v1 (Aura TTS): remove SpeakV1Model.AURA2PERSEO_IT, AudioGenerateRequestModel.AURA2PERSEO_IT, their Value enum entries, and the associated Visitor.visitAura2PerseoIt() methods. The aura-2-perseo-it model was never served by the API and is no longer in the specification. Use a supported Speak v1 model instead. See the v0.9 to v0.10 migration guide.

Features

• Agent: add AgentV1ForceEndTurn and V1WebSocketClient#sendForceEndTurn(...) to end the current turn on demand. Agent Deepgram speak providers using Flux (version: "v2") also accept expressivity, a whole-number calm-to-animated setting from -2 to 2; 0 is the default. (#100) (cbadf05)
• Speak v2 (Flux TTS): batch requests and WebSocket connections accept expressivity from -2 to 2. speed now accepts values from 0.5 to 1.5 in 0.05 increments, instead of 0.85 to 1.15. (#100) (cbadf05)

... (truncated)

Commits

• 695b3f8 chore(main): release 0.11.0 (#121)
• 01f75a4 feat(regen)!: add Flux TTS Controls (#120)
• a60608d chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.18.9 to ...
• 5465b71 chore(main): release 0.10.2 (#115)
• ff9fdd4 feat(regen): add AutoCloseable client lifecycle and Flux runtime numerals (#114)
• c99e7cd chore(main): release 0.10.1 (#112)
• eeb39b4 docs(readme): document SDK JSON mapper (#109)
• be27248 feat(regen): agent function cancellation and defer-until-EOT (#110)
• 4e05eae chore(deps): bump assertj-core to 3.27.7 (#111)
• 799e63f chore(main): release 0.10.0 (#101)
• Additional commits viewable in compare view

Updates com.tngtech.archunit:archunit-junit5 from 1.5.0 to 1.5.1

Release notes

Sourced from com.tngtech.archunit:archunit-junit5's releases.

ArchUnit 1.5.1

Bug fixes

Core

• fix: include java.lang.IO in ACCESS_STANDARD_STREAMS (#1687; thanks to @​arimu1 👋)
• Count caught exception types as type dependencies (#1725; by @​schulzjo-tng)

Internal Improvements

• publish archunit-junit-relocation (#1684; thanks to @​hankem 👋)

Commits

• 6c2d659 prepare release 1.5.1
• d5ff417 set snapshot version to 1.5.1 in preparation of release
• aee04c5 Update Gradle Wrapper from 9.7.1 to 9.8.0 (#1727)
• 73535af Update Gradle Wrapper from 9.7.1 to 9.8.0
• 058f709 Count caught exception types as type dependencies (#1732) (#1725)
• fbcc47c Count caught exception types as type dependencies (#1732)
• e78e136 Bump io.github.ben-manes.versions from 0.63.0 to 0.64.0
• a0a8aff Bump io.github.ben-manes.versions from 0.62.0 to 0.63.0
• d30f80d Bump io.github.ben-manes.versions from 0.61.0 to 0.62.0
• 22c0f6a Bump actions/setup-java from 6.0.0 to 6.0.1
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.10.0 to 8.10.4

Release notes

Sourced from com.diffplug.spotless's releases.

Gradle Plugin v8.10.4

Changes

• Bump default eclipse version from 4.40 to 4.41.
• spotlessInstallGitPrePushHook now respects Git’s core.hooksPath when installing the pre-push hook, instead of always writing to .git/hooks. (#3115
• Bump default gherkin version 42.0.0 -> 42.0.1. (#3088)
• Bump default jackson version 2.22.2 -> 2.22.3. (#3101)
• Bump default palantir-java-format version 2.98.0 -> 2.102.0. (#3103, #3132)
• Bump default mockito-core version 5.23.0 -> 5.24.0. (#3106)
• Bump default greclipse version to latest 4.40 -> 4.41. (#3123)
• Bump default ktfmt version 0.64 -> 0.65. (#3135)
  Which moved to the org.jetbrains.kotlinx:ktfmt coordinate and org.jetbrains.kotlinx.ktfmt package. Older versions are still supported.
• Bump default palantir-java-format version 2.99.0 -> 2.102.0. (#3132)

Fixed

• shortenFullyQualifiedTypes leaves a qualified name alone when the enclosing type extends or implements a type that is not in the same file, so an inherited member type cannot take the simple name. (#3117)
• expandWildcardImports no longer drops the import of a type that is only used to qualify a static member (such as Collections.sort(list) or TimeUnit.SECONDS), or the static import of a field or enum constant (such as PI from import static java.lang.Math.*), which produced code that did not compile. (#2833)

Gradle Plugin v8.10.3

Changes

• Generate formatter defaults from version catalog. (#3045)
• Bump default gson version 2.13.2 -> 2.14.0. (#3045)
• Bump default zjsonpatch version 0.4.14 -> 0.4.16. (#3045)
• Bump default jackson-dataformat-yaml version 2.14.1 -> 2.20.1. (#3045)
• Bump default ktfmt version 0.63 -> 0.64. (2988)
• Bump default cleanthat version 2.25 -> 2.26. (#2882)
• Bump default jackson version 2.20.1 -> 2.22.2. (#2819)
• Bump default javaparser version 3.27.1 -> 3.28.2. (#3065)
• Bump default palantir-java-format version 2.80.0 -> 2.98.0. (#3068)
• Bump default scalafmt version 3.8.1 -> 3.11.5. (#2173)
• Bump default google-java-format version 1.30.0 -> 1.36.1. (#3075)
• Bump default gherkin-utils version 10.0.0 -> 12.0.2. (#2979)
• We no longer publish a plugin marker for the legacy com.diffplug.gradle.spotless id, which has been redirecting to com.diffplug.spotless since 4.0. Builds that still request it now fail with Plugin [id: 'com.diffplug.gradle.spotless'] was not found instead of the migration message. (#3086)

Fixed

• Fix release signing by using Gradle's required eight-digit signing subkey ID. (#3105)
• Fix race when creating the npm install cache directory. ((#3096)
• GrEclipse no longer emits expected OSGi and nested-jar warnings during initialization. (#2445)
• typescript prettier() no longer emits a warning when its parser is already set to typescript. (#3098)
• versionCatalog() preserves standalone comments at section boundaries and the end of the file. (#3048)
• versionCatalog() preserves entries when comments contain unmatched brackets, preserves commas inside quoted strings, and keeps significant line boundaries in multiline entries. (#3042)
• versionCatalog() now reports unfinished entries as lints at their starting line. These fail formatting by default, so upgrading may expose catalog errors that previously caused silent data loss. (#3042)
• Stop calling deprecated Configuration.setVisible from Gradle 9.0.0 (#3053)
• Eclipse JDT formatter step no longer fails with NoClassDefFoundError or NoSuchMethodError when lombok is active as a JVM agent (e.g. -javaagent:lombok.jar in Eclipse/VS Code/Cursor). (#2795)

Gradle Plugin v8.10.2

Fixed

• shortenFullyQualifiedTypes() now shortens fully-qualified types used in expression contexts (such as static method calls, static fields, and enum constants) while avoiding imports that would change how existing unqualified type references resolve. (#3039)
• Eclipse JDT formatter step no longer fails with NoClassDefFoundError when lombok is active as a JVM agent (e.g. -javaagent:lombok.jar in Eclipse/VS Code/Cursor). (#2795)

Gradle Plugin v8.10.1

... (truncated)

Commits

• d9e7a41 Published gradle/8.10.4
• c006d66 Published lib/4.10.4
• 8adb835 Merge release publishing fixes into main (#3138)
• 67b4dbf Remove internal publishing changes from release notes
• b9c4830 Keep Rewrite plugin on publicly resolvable releases (#3036)
• 1c93df4 Update dependency com.palantir.javaformat:palantir-java-format to v2.102.0 (#...
• ab153a9 Keep Rewrite plugin on publicly resolvable releases
• feb10d8 Update plugin rewrite to v7.41.0
• 2083664 Update changelogs for default formatter version bump (#3132)
• 7742abc Consolidate Palantir formatter changelog entries (#3132)
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.7.1 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.